# US 11,113,393 B2 · Providing security features in write filter environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,393 B2 - Document ID: US11113393B2 - Status: Granted - Kind: B2 - Application number: 16/673,714 - Filed: 2019-11-04 - Published: 2021-05-06 - Granted: 2021-09-07 - Earliest claimed: 2019-11-04 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: Gokul Thiruchengode Vajravel; Ankit Kumar; Abhishek Mathur - Web page: https://patentgrep.com/patent/US11113393B2 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/54: by adding security routines or objects to programs - G06F 21/6281: {at program execution time, where the protection is within the operating system} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A security client can provide security features in write filter environments. To prevent improper modifications to a protected volume, the security client can be employed to differentiate between direct I/O requests and reparsed I/O requests that are directed to a shadow volume and to block any direct I/O requests. Alternatively or additionally, the security client can be configured to determine whether an I/O request that is directed to the shadow volume targets an artifact in the write filter's exclusion list, and if not, block the I/O request. Alternatively or additionally, the security client can be configured to monitor registry operations to determine whether a modifying registry operation targets the write filter's persistent shadow registry hive, and if so, allow the modifying registry operation only if it targets a registry key in the write filter's exclusion list. ## Claims ### Claim 1 A method, performed by a security client on a computing device, for providing security features in a write filter environment that includes a protected I/O stack on which a write filter is loaded to prevent modification to artifacts on a protected volume and an unprotected I/O stack by which the write filter enables excluded artifacts to be modified, the method comprising: receiving, at a minifilter of the security client that is loaded on the unprotected I/O stack, an I/O request; determining, by the minifilter, whether the I/O request is a reparsed I/O request or a direct I/O request; when the minifilter determines that the I/O request is a reparsed I/O request, allowing the I/O request to be passed down the unprotected I/O stack; and when the minifilter determines that the I/O request is a direct I/O request, blocking the I/O request. ### Claim 2 (depends on 1) The method of claim 1, wherein determining that the I/O request is a reparsed I/O request comprises determining that the I/O request includes a tag that was added by another minifilter that is loaded on the protected I/O stack. ### Claim 3 (depends on 2) The method of claim 2, wherein the tag comprises Extended Create Parameters of the I/O request. ### Claim 4 (depends on 2) The method of claim 2, further comprising: prior to the minifilter receiving the I/O request, receiving, by the other minifilter that is loaded on the protected I/O stack, the I/O request; and adding, by the other minifilter, the tag to the I/O request. ### Claim 5 (depends on 4) The method of claim 4, wherein the other minifilter adds the tag to the I/O request upon determining that the write filter has reparsed the I/O request. ### Claim 6 (depends on 4) The method of claim 4, wherein the other minifilter is the write filter and adds the tag to the I/O request as part of reparsing the I/O request. ### Claim 7 (depends on 1) The method of claim 1, wherein determining that the I/O request is a reparsed I/O request comprises determining that the I/O request targets an excluded artifact. ### Claim 8 (depends on 7) The method of claim 7, wherein determining that the I/O request targets an excluded artifact comprises: evaluating the I/O request to identify an artifact that the I/O request targets; comparing the identified artifact to an exclusion list; and determining that the identified artifact is included in the exclusion list. ### Claim 9 (depends on 8) The method of claim 8, further comprising: receiving, by the minifilter and from a service, the exclusion list; and storing, by the minifilter, the exclusion list. ### Claim 10 (depends on 1) The method of claim 1, further comprising: receiving, at a registry filter of the security client, a registry operation; determining, by the registry filter, that the registry operation targets a persistent shadow registry hive that the write filter employs to enable excluded registry keys to be modified; determining, by the registry filter, that the registry operation does not target an excluded registry key; and blocking, by the registry filter, the registry operation. ### Claim 11 (depends on 10) The method of claim 10, wherein determining that the registry operation targets the persistent shadow registry hive comprises: determining a path of a registry key that the registry operation targets; and determining that the persistent shadow registry hive encompasses the path. ### Claim 12 (depends on 11) The method of claim 11, wherein determining that the registry operation does not target an excluded registry key comprises: comparing the registry key to a registry exclusion list; and determining that the registry key is not included in the registry exclusion list. ### Claim 13 One or more computer storage media storing computer executable instructions which when executed on a computing device implement a security client that is configured to provide security features in a write filter environment that includes a protected I/O stack on which a write filter is loaded to prevent modification to artifacts on a protected volume and an unprotected I/O stack by which the write filter enables excluded artifacts to be modified, the security client providing the security features by performing a method comprising: receiving, at a minifilter of the security client that is loaded on the unprotected I/O stack, a first I/O request; determining, by the minifilter, that the first I/O request is a direct I/O request; in response to determining that the first I/O request is a direct I/O request, blocking the first I/O request; receiving, at the minifilter, a second I/O request; determining, by the minifilter, that the second I/O request is a reparsed I/O request; and in response to determining that the second I/O request is a reparsed I/O request, allowing the second I/O request. ### Claim 14 (depends on 13) The computer storage media of claim 13, wherein determining that the first I/O request is a direct I/O request and that the second I/O request is a reparsed I/O request comprises one of: determining that the second I/O request includes a tag that was added by another minifilter and that the first I/O request does not include the tag; or determining that first I/O request does not target an excluded artifact and that the second I/O request targets an excluded artifact. ### Claim 15 (depends on 13) The computer storage media of claim 13, wherein the method further comprises: receiving, at a registry filter of the security client, a registry operation; determining, by the registry filter, that the registry operation targets a persistent shadow registry hive that the write filter employs to enable excluded registry keys to be modified; determining, by the registry filter, that the registry operation does not target an excluded registry key; and blocking, by the registry filter, the registry operation. ### Claim 16 (depends on 15) The computer storage media of claim 15, wherein determining that the registry operation targets the persistent shadow registry hive comprises: determining a path of a registry key that the registry operation targets; and determining that the persistent shadow registry hive encompasses the path; and wherein determining that the registry operation does not target an excluded registry key comprises: comparing the registry key to a registry exclusion list; and determining that the registry key is not included in the registry exclusion list. ### Claim 17 A method, performed by a security client on a computing device, for providing security features in a write filter environment that includes a protected I/O stack on which a write filter is loaded to prevent modification to artifacts on a protected volume and an unprotected I/O stack by which the write filter enables excluded artifacts to be modified, the method comprising: receiving, at a first minifilter of the security client that is loaded on the protected I/O stack, a first I/O request; detecting, by the first minifilter, that the first I/O request is reparsed; in response to detecting that the first I/O request is reparsed, adding, by the first minifilter, a tag to the first I/O request; receiving, at a second minifilter of the security client that is loaded on the unprotected I/O stack, the first I/O request; determining, by the second minifilter, that the first I/O request includes the tag; and in response to determining that the first I/O request includes the tag, allowing the first I/O request. ### Claim 18 (depends on 17) The method of claim 17, further comprising: receiving, at the second minifilter, a second I/O request; determining, by the second minifilter, that the second I/O request does not include the tag; and in response to determining that the second I/O request does not include the tag, blocking the second I/O request. ### Claim 19 (depends on 18) The method of claim 18, wherein the tag comprises Extra Create Parameters. ### Claim 20 (depends on 18) The method of claim 18, wherein the first minifilter is one of: loaded above the write filter; loaded above the write filter and an overlay optimizer; or the write filter.